Question

Wireshark supports filters like this:

ip.addr == 192.168.0.1

What is the syntax to check the packet content?

(C# equivalent of what I want)

content.Contains("whateverYouWant")

Answer 1

There seems not to be an generic way of doing this. Filter you need to apply is dependent on the protocol you are listening. Try looking at filter list at http://www.wireshark.org/docs/dfref/.

Answer 2

Try the "contains" or "matches" operators.

tcp contains "an aloof iguana"
http matches "my pass.+ is(?i)"

Contains does a simple case-sensitive string comparison, and is guaranteed to be in every Wireshark package. Matches lets you apply Perl-compatible regular expressions. Its availability depends on your platform. You can also use contains with byte strings:

ip contains 01:ab:9c:45